<?php

namespace App\Http\Middleware;

use App\Enums\Permission;
use App\Services\Tenant\TenantContext;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class EnsureStaffPermission
{
    public function handle(Request $request, Closure $next, string $permission): Response
    {
        $permissionCase = Permission::tryFrom($permission);
        $business = app(TenantContext::class)->require();
        $staff = $request->user()?->staffProfiles()
            ->where('businessId', $business->id)
            ->with('role.permissions')
            ->first();

        abort_unless($permissionCase && $staff?->hasPermission($permissionCase), 403);

        return $next($request);
    }
}